@modelprofile.com/authswitch 6.5.0 → 8.0.0

package/ts/interfaces.harness.ts

@@ -73,7 +73,13 @@ export interface IHarnessCredentialDrift {
 
 /** Account IDs are opaque and scoped to one harness. Credentials never cross this interface. */
 export interface IHarnessAccount {
+  /** Opaque authswitch identifier used for harness operations. */
   id: string;
+  /**
+   * Stable account identifier reported by the provider, scoped by this harness and `slotId`.
+   * Null means the credential carries no exact provider identity. Never infer it from `id` or `label`.
+   */
+  providerAccountId: string | null;
   label: string;
   /** Accounts in different slots can be active together (for example OpenCode providers). */
   slotId?: string;

package/ts/interfaces.list.ts

@@ -2,7 +2,7 @@ import type { IAccountType, IHarnessAccount, IHarnessAccountStatus, IHarnessBill
 
 /** Credential-free, versioned output of list --json. Missing status fields stay omitted. */
 export interface IAccountList {
-  schemaVersion: 2;
+  schemaVersion: 3;
   generatedAt: string;
   complete: boolean;
   harnesses: IHarnessAccountList[];
@@ -22,7 +22,7 @@ export interface IHarnessAccountList {
 
 /** Credential-free, versioned output of limits --json. One entry per account and limit type. */
 export interface IAccountLimits {
-  schemaVersion: 1;
+  schemaVersion: 2;
   generatedAt: string;
   complete: boolean;
   limits: IAccountLimitRow[];
@@ -36,6 +36,9 @@ export interface IAccountLimitRow {
   provider: string;
   /** The account's public label, which is its email wherever the provider reports one. */
   account: string | null;
+  /** Exact provider-native account identifier; null when unavailable or this row names no account. */
+  providerAccountId: string | null;
+  /** Opaque authswitch account identifier used for harness operations. */
   accountId: string | null;
   slotId?: string;
   isActive: boolean;
@@ -61,7 +64,7 @@ export interface IAccountLimitRow {
 
 /** Credential-free, versioned output of active --json. One entry per active credential slot. */
 export interface IActiveAccounts {
-  schemaVersion: 1;
+  schemaVersion: 2;
   generatedAt: string;
   complete: boolean;
   active: IActiveAccountRow[];
@@ -72,6 +75,9 @@ export interface IActiveAccountRow {
   harnessId: string;
   provider: string;
   account: string | null;
+  /** Exact provider-native account identifier; null when unavailable or this row names no account. */
+  providerAccountId: string | null;
+  /** Opaque authswitch account identifier used for harness operations. */
   accountId: string | null;
   slotId?: string;
   /** The adapter's plan name (`max`, `pro`), sanitised but not display-formatted; null when none is known or the row names no account. */

package/ts/plugins.ts

@@ -24,14 +24,19 @@ export type TProperLockfile = typeof properLockfile;
  */
 export const loadProperLockfile = (): Promise<TProperLockfile> => import('proper-lockfile');
 
+// @lossless.org modules
+/** Account document models, sessions and exact persistence. */
+import * as nosqldb from '@lossless.org/client/nosqldb';
+/** The embedded engine that hosts the per-user account database behind a private Unix socket. */
+import * as nosqldbEngine from '@lossless.org/nosqldb';
+export { nosqldb, nosqldbEngine };
+
 // @push.rocks modules
 import * as smartconsole from '@push.rocks/smartconsole';
-import * as smartdata from '@push.rocks/smartdata';
-import * as smartdb from '@push.rocks/smartdb';
 import * as smartsecret from '@push.rocks/smartsecret';
 import * as smartdaemon from '@push.rocks/smartdaemon';
 import * as typedrequest from '@api.global/typedrequest';
-export { smartconsole, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
+export { smartconsole, smartsecret, smartdaemon, typedrequest };
 
 // @modelprofile.com modules
 import * as flexModels from '@modelprofile.com/flexharness-models';

package/ts/ts_migration/0001_authority_meta.ts

@@ -0,0 +1,45 @@
+import * as plugins from '../plugins.js';
+
+const reserved = new Set(['_id', '_smartdataRevision', '_createdAt', '_updatedAt']);
+const currentKeys = ['id', 'epoch', 'revision', 'updateId'];
+const uuid = (value: unknown): boolean => typeof value === 'string' && /^[a-f0-9-]{36}$/.test(value);
+
+/**
+ * Brings the metadata document of every published release to the current shape, under the exclusive
+ * LocalNoSqlDb root owner. 6.4/6.5 wrote exactly the current shape. 7.0.0 added `schemaVersion: 2` and an
+ * `admission` marker; both are removed in one compare-and-set, and an unreleased build that had already
+ * dropped `schemaVersion` loses the marker the same way. A store whose marker is not `open` was closed by a
+ * restore and is refused, never opened. Every other document is refused as unknown.
+ *
+ * The stored shape is the only record of completion: no ledger of applied module ids exists. That is what
+ * makes rewriting this published module in place sound, and it holds only while every accepted shape maps to
+ * the current one in at most one atomic write and the current shape maps to itself.
+ */
+export const migrateAuthorityMeta = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  const collection = db.mongoDb.collection('authswitch_authority_meta');
+  const stored = await collection.findOne({ id: 'authswitch-authority' });
+  if (!stored) throw new Error('Existing authswitch authority database has no metadata.');
+  const body = Object.fromEntries(Object.entries(stored).filter(([key]) => !reserved.has(key)));
+  const hasSchemaVersion = Object.hasOwn(body, 'schemaVersion');
+  const hasAdmission = Object.hasOwn(body, 'admission');
+  if (Object.keys(body).length !== currentKeys.length + Number(hasSchemaVersion) + Number(hasAdmission)
+    || !currentKeys.every(key => Object.hasOwn(body, key))
+    || (hasSchemaVersion && (!hasAdmission || body.schemaVersion !== 2))
+    || (hasAdmission && body.admission !== 'open' && body.admission !== 'closed_restored')
+    || body.id !== 'authswitch-authority' || !uuid(body.epoch) || !uuid(body.updateId)
+    || !Number.isSafeInteger(body.revision) || Number(body.revision) < 0) {
+    throw new Error('Existing authswitch authority metadata has an unknown schema.');
+  }
+  if (!hasAdmission) return;
+  if (body.admission !== 'open') {
+    throw new Error('Authswitch authority store was closed by a restore and cannot be opened; '
+      + 'set the store aside and log in to each account again.');
+  }
+  const result = await collection.updateOne(
+    { _id: stored._id, id: 'authswitch-authority', admission: 'open',
+      schemaVersion: hasSchemaVersion ? 2 : { $exists: false } },
+    { $unset: hasSchemaVersion ? { schemaVersion: '', admission: '' } : { admission: '' } });
+  if (result.matchedCount !== 1 || result.modifiedCount !== 1) {
+    throw new Error('Authswitch authority metadata migration did not commit exactly once.');
+  }
+};

package/ts/ts_migration/0002_remove_backup_records.ts

@@ -0,0 +1,49 @@
+import * as plugins from '../plugins.js';
+
+const digestCollections = ['authswitch_authority_handoffs', 'authswitch_authority_migration_ledger'];
+
+/**
+ * Removes what the retired backup and restore system left in the store, under the exclusive LocalNoSqlDb root
+ * owner. 6.4.0 to 7.0.0 stored a `backupDigest` on every native handoff and migration ledger row; no release
+ * ever wrote a non-null one, so a null digest is unset and a non-null one refuses the store. Only a 7.0.0
+ * restore could mark a preuse receipt `restored_history_uncertain`, and a restore never targeted a real store, so
+ * that receipt refuses the store as well. A verified or complete ledger row must name its imported account and
+ * grant; one that does not was never written by this package and is refused. Every refusal is decided before the
+ * first write, so a refused store is left exactly as it was.
+ *
+ * The stored shape is the only record of completion: no ledger of applied module ids exists. Each row is
+ * rewritten by its own compare-and-set, so an interrupted run leaves rows this module already recognises and the
+ * next start finishes them. Once migrated, a start costs one unindexed pass over the operation receipts, of the
+ * same order as the state reconciliation every start already performs, and passes over two collections that
+ * hold one row per imported source.
+ */
+export const removeAuthorityBackupRecords = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  const operations = db.mongoDb.collection('authswitch_authority_operations');
+  if (await operations.findOne({ problem: 'restored_history_uncertain' })) {
+    throw new Error('Authswitch authority store holds a receipt written by a restore and cannot be opened; '
+      + 'set the store aside and log in to each account again.');
+  }
+  const ledger = db.mongoDb.collection('authswitch_authority_migration_ledger');
+  if (await ledger.findOne({ status: { $in: ['verified', 'complete'] }, $or: [{ accountId: null }, { grantId: null }] })) {
+    throw new Error('Authswitch authority store holds a verified migration without its imported account and grant.');
+  }
+  const carriers = [];
+  for (const name of digestCollections) {
+    const collection = db.mongoDb.collection(name);
+    if (!await collection.findOne({ backupDigest: { $exists: true } })) continue;
+    if (await collection.findOne({ backupDigest: { $exists: true, $ne: null } })) {
+      throw new Error('Authswitch authority store holds backup proof no release could have recorded.');
+    }
+    carriers.push(collection);
+  }
+  for (const collection of carriers) {
+    const carrier = { backupDigest: { $exists: true } };
+    for (let stored = await collection.findOne(carrier); stored; stored = await collection.findOne(carrier)) {
+      const result = await collection.updateOne({ _id: stored._id, backupDigest: null },
+        { $unset: { backupDigest: '' } });
+      if (result.matchedCount !== 1 || result.modifiedCount !== 1) {
+        throw new Error('Authswitch authority backup record removal did not commit exactly once.');
+      }
+    }
+  }
+};

package/ts/ts_migration/index.ts

@@ -0,0 +1,12 @@
+import * as plugins from '../plugins.js';
+import { migrateAuthorityMeta } from './0001_authority_meta.js';
+import { removeAuthorityBackupRecords } from './0002_remove_backup_records.js';
+
+/**
+ * Runs on every start of an existing store, in this fixed order. Each module recognises the published shapes it
+ * upgrades and leaves the current shape untouched, so the stored document itself records completion.
+ */
+export const runAuthorityMigrations = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  await migrateAuthorityMeta(db);
+  await removeAuthorityBackupRecords(db);
+};